Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of cedric.couralet@gmail.com
 designates 209.85.217.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <524985E5.8070208@christopherschultz.net>
References: 
 <CACcTOYmSsQzLb3a9rJGkK+-RK2dQ947N5BuP_BV7WvwmFr=_-A@mail.gmail.com>
	<260E16ED-D26E-4CD6-983C-CFE4E0BD1FD9@gopivotal.com>
	<52497877.9040909@ice-sa.com>
	<CACcTOYnP0=Of_CNLX_AL2RRS3Cv-P_9ZqXTh-1tHQO8iMgZEoA@mail.gmail.com>
	<52497F30.70202@ice-sa.com>
	<CAMwoAzc8AZYF+huvJA8t_0eXR_Ktdn5Y+6YwgsztQemyW-OdRw@mail.gmail.com>
	<524985E5.8070208@christopherschultz.net>
Date: Mon, 30 Sep 2013 16:15:40 +0200
Message-ID: 
 <CAMwoAzeaU7_L44huWuBFP=qVBGh_vmmHFh_i00u8Z8MCGEpZSw@mail.gmail.com>
Subject: Re: Apache HTTP + Tomcat + SSL
From: =?ISO-8859-1?Q?C=E9dric_Couralet?= <cedric.couralet@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

2013/9/30 Christopher Schultz <chris@christopherschultz.net>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> C=E9dric,
>
> On 9/30/13 10:06 AM, C=E9dric Couralet wrote:
>> Hi,
>>
>> 2013/9/30 Andr=E9 Warnier <aw@ice-sa.com>:
>>> Hi.
>>>
>> [...]
>>> The question is now : why does that application require HTTPS ?
>>> An application usually doesn't care how it is accessed, except if
>>> some configuration of the application requires it to get some
>>> information from the SSL protocol (like a user certificate or
>>> so).  What does this application need ?
>>>
>>>
>>
>> I don't agree, the application should know how it is accessed, if
>> only because some pages may require SSL (all page under an
>> auth-constraint) and others not, and it should not be delegated to
>> apache but required at the tomcat level. I really think that saying
>> to an application  "do not care about SSL it is our problem"  will
>> lead to all sort of security incomprehension in the future.
>> Espcially when it is as easy as adding a valve in server.xml to do
>> so (as said by Daniel Mikusa), or if it is an option, configuring
>> AJP between tomcat and httpd, which then requires nothing on the
>> tomcat side.
>
> Some solutions require nothing on the Tomcat site (hint: mod_jk does
> all this auto-magically).
>

I didn't say otherwise (

>> "configuring
>> AJP between tomcat and httpd, which then requires nothing on the
>> tomcat side" )

I just reacted to the saying that an application could not care
whether it was accessed with SSL or not, I think the choice of https
over http is an application choice and it could be dangerous to say
that it is not important for an application to think about it.

I agree with all the rest, just that sentence which made me uneasy (in
lack of a better term ).

C=E9dric

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org